International Conference on Quantum Communications, Networking, and Computing (QCNC)
Using ALTO Protocol to Address SD-QKD Federation in Multi-Domain Scenarios
Alejandro Muñiz, R. Cantó, Luis M. Contreras, Antonio Pastor, Diego R. Lopez, J. Morales, Jesús Folgueira, Juan P. Brito, Rubén B. Méndez, Jesús Ballesta, Vicente Martín, Pietro Piscione, Pietro G. Giardina, Ahmed K Abdulwahed
Quantum Key Distribution (QKD) technologies are rapidly evolving from a set of isolated mono vendor links, towards real networks with relay schemes able to flexibly interconnect applications accessing their key serving nodes. To that end, Software-Defined Networking (SDN) technologies are being proposed as the paradigm to provide SD-QKD nodes with the necessary network topology information to establish QKD services based on Service-Level Agreements (SLAs) and will be essential in many of the national EuroQCI deployments. However, existing SDN solutions in multi-domain scenarios with little information of other domains, such as the ones foreseen in the future multi-national Euro-QCI. This paper proposes leveraging the Application-Layer Traffic Optimization (ALTO) protocol to enhance network visibility and streamline interconnection procedures, the main goal is to do a theoretical approach to the solution, defining how the implementation of the solution should be if we follow the current standardization of used technologies. ALTO facilitates identifying optimal QKD paths and adhering to service agreements across diverse domains, offering a novel solution to SDN deployment challenges. Its integration promises improved network management and unprecedented interoperability in QKD networks, advancing SDN and multi-layer networking.
Quantum Key Distribution (QKD) technologies are rapidly evolving from a set of isolated mono vendor links, towards real networks with relay schemes able to flexibly interconnect applications accessing their key serving nodes. To that end, Software-Defined Networking (SDN) technologies are being proposed as the paradigm to provide SD-QKD nodes with the necessary network topology information to establish QKD services based on Service-Level Agreements (SLAs) and will be essential in many of the national EuroQCI deployments. However, existing SDN solutions in multi-domain scenarios with little information of other domains, such as the ones foreseen in the future multi-national Euro-QCI. This paper proposes leveraging the Application-Layer Traffic Optimization (ALTO) protocol to enhance network visibility and streamline interconnection procedures, the main goal is to do a theoretical approach to the solution, defining how the implementation of the solution should be if we follow the current standardization of used technologies. ALTO facilitates identifying optimal QKD paths and adhering to service agreements across diverse domains, offering a novel solution to SDN deployment challenges. Its integration promises improved network management and unprecedented interoperability in QKD networks, advancing SDN and multi-layer networking.
The importance of quantum-key-distribution (QKD) networks is growing rapidly, not only because the underlying QKD protocol is immune against any (known or unknown) attacks but also as these infrastructures can be operated in a hybrid mode, together with emerging quantum safe, or post quantum cryptography (PQC), public key protocols. Hybrid solutions appear to be the most promising remedy against real-world security risks, posed by prospective quantum computers. Simultaneously, telecommunication operators are embracing novel network paradigms, such as software-defined networking (SDN), due to distinct advantages over traditional approaches. SDN-inspired architectures can also be used for QKD and hybrid QKD-PQC networks. These architectures allow a seamless integration of QKD and hybrid QKD-PQC into production networks, significantly increasing the security of the latter. However, there has only been very limited research on optimal strategies for establishing hybrid connectivity across different organizational domains. The present contribution introduces two methods on interconnecting different technological and administrative domains for such networks. The proposed scheme is QKD-vendor independent and relies heavily on standard and open interfaces. It enables a complete end-to-end communication between applications running on nodes in different domains. It can be used for the secure interconnection of different SDN-based telecommunication domains with additional QKD / hybrid protection and has been tested within the Madrid Quantum-Communication Infrastructure.
Quantum Key Distribution (QKD) is one of the major cryptographic solutions to tackle the security threats associated to future computational advances, in particular those coming from quantum computing. At the most simple level, QKD can be seen as a highly secure source of symmetric secret keys in two separated places. Nonetheless, the lack of standardization and the strong requirements from the physical layer makes this technology very difficult to integrate in existing infrastructure.However, the success of QKD networks radically depends on the degree in which they can be adopted in the existing infrastructure, and it is a must that it happens via standard protocols and interfaces. The flexibility of novel network paradigms, like Software-Defined Networking (SDN), allows for a faster adoption of new concepts, hardware and services in telecommunications networks. This paradigm can be used for quantum communications, allowing for a fast and scalable deployment of quantum technologies and services in the telecommunications network to a degree that was simply impossible in previous schemes, where the different network devices and their connections should be modified, one by one, to create a quantum communications channel.This tutorial provides an introduction to existing QKD technologies and networks, followed by a descriptive explanation on how SDN principles can be utilized to abstract and integrate QKD systems as part of the network management. This will help to reduce the time-to-market for quantum technologies, and also will make quantum cryptography available as a service to be capitalized by the network operators.
This paper demonstrates the use of software-defined networking (SDN) orchestration to integrate regionally separated networks in which different network parts use incompatible key management systems (KMSs) managed by different SDN controllers to ensure end-to-end QKD service provisioning to deliver the QKD keys between geographically different QKD networks. The study focuses on scenarios in which different parts of the network are managed separately by different SDN controllers, requiring an SDN orchestrator to coordinate and manage these controllers. In practical network deployments, operators often utilize multiple vendors for their network equipment. This practice also enables the expansion of the QKD network's coverage by interconnecting various QKD networks equipped with devices from different vendors. However, as coordinating different parts of the QKD network is a complex task, this paper proposes the implementation of an SDN orchestrator which acts as a central entity to manage multiple SDN controllers, ensuring end-to-end QKD service provisioning to address this challenge. For instance, when there are multiple border nodes to interconnect different networks, the SDN orchestrator calculates the path in advance for the end-to-end delivery of keys between initiating and target applications belonging to different networks. This path selection requires the SDN orchestrator to gather information from each SDN controller managing the respective parts of the QKD network. This work shows the practical implementation of SDN orchestration for interoperable KMS in commercial QKD networks in South Korea. By employing an SDN orchestrator, it becomes possible to coordinate multiple SDN controllers and ensure the efficient and secure delivery of QKD keys between different QKD networks with varying vendor equipment.
The global Internet appears to users as a unified, seamless infrastructure, but in reality, it is composed of multiple interconnected networks: separate domains with different management and policies. This unified behavior is made possible by complexity-hiding mechanisms and inter-domain coordination protocols, which are critical components of modern networking. As we approach a paradigm shift driven by quantum technologies, new challenges and opportunities emerge. Quantum information processing enables capabilities that classical systems cannot achieve, including the potential to compromise public key infrastructures that support today’s network security. Quantum key distribution (QKD) offers a promising avenue by implementing a key agreement protocol that is information-theoretically secure against computational attack. However, to fully leverage QKD, networks must be adapted to the unique constraints of quantum communication, integrating both quantum bit transmission and secure key distribution across multiple domains. This paper discusses the interconnection of quantum key distribution networks (QKDNs) and presents a distributed, standards-aligned orchestration mechanism designed to manage QKD networks spanning multiple administrative domains. Our solution builds on existing QKDN standards to facilitate interoperability and practical deployment in heterogeneous environments and has been validated on a heterogeneous multi-domain network comprising three interconnected autonomous domains.
A multi-vendor, multi-domain Quantum Key Distribution network comprising 15 nodes across three independently managed domains was deployed and operated during QCI Days 2025 in Athens. The large-scale field trial integrated heterogenous QKD technologies, multi-layer Key Management Systems, and SDN-controlled infrastructures into a unified inter-domain architecture enabling cross-domain key exchange and coordination. The setup combined in-rack domain nodes extended to a 4-node field-deployed metropolitan QKD network segment, providing a realistic operational environment for validating end-to-end functionality. Multiple QKD-enabled services were successfully supported across the federated infrastructure, proving the technical feasibility and viability of scalable QKD deployments in inter-domain settings.
Software-defined networking (SDN) has emerged as a promising paradigm for managing and controlling network resources efficiently. However, ensuring the security of data packets transmitted within an SDN environment remains a critical challenge. Traditional networking relies on static configurations, while SDN offers dynamic control and programmability, revolutionizing network management. In SDN, the application layer employs tools like OpenDaylight and Mininet for network management and testing. The control layer, managed by controllers such as Floodlight or ONOS, orchestrates traffic flow among switches. In the infrastructure layer, Quantum Key Distribution (QKD) with the BB84 protocol ensures secure communication. Together, these layers enable agile, programmable, and secure networking paradigms. This paper proposes integrating quantum key distribution (QKD) into SDN architectures to bolster packet-level security. By leveraging quantum entanglement and uncertainty, a secure communication channel between SDN controllers and switches is established, resilient to quantum attacks. Evaluation through simulations and real-world experiments demonstrates efficacy in mitigating security threats while minimizing overhead and latency, advancing SDN security IEEE 802.1X capabilities and leveraging quantum technologies for cybersecurity.